Alchemix Transmuter

Vulnerability details

The safeApprove() function of Openzeppelin SafeERC20 library has been deprecated. As it has been mentioned here : openzeppelin issue

safeApprove() has been used in the following places:

1. StrategyArb::constructor code

2. StrategyArb::_initStrategy code

3. StrategyArb::setRouter code

4. StrategyOp::constructor code

5. StrategyOp::_initStrategy code

6. StrategyOp::setRouter code

7. StrategyMainnet::constructor code

8. StrategyMainnet::_initStrategy code

Similar issue : https://github.com/code-423n4/2024-07-reserve-validation/issues/175

Impact

As mentioned by Openzeppelin, it makes the function susceptible to frontrunning or sandwich attacks

Tools used

Manual review

Recommended mitigation

Whenever possible, use safeIncreaseAllowance and safeDecreaseAllowance instead.